YARA performance bits

yara-perf-bits.txt

#0:
strings are always evaluated first
filesize < 100KB will not help

#1:
// condition order does not matter, will only short-circuit
condition:
  $str1 and $str2 and uint16(0) == 0xFFFF and ...
  uint16(0) == 0xFFFF and $str1 and $str2 and ...

#2:
// avoid these for maximum size atom generation (0-4)
// atom-size influences speed
avoid regex .* .+ .*?
without upper bound (14,)
too large (1,300000)
big jumps 02 [1-100] 04
alternation { 00 (3E|4B) 3C 00 } // { 00 3E 3C 00} or {00 4B 3C 00}
add more specification, fullword
avoid nocase

#3:
better to shortcircuit with uint32()
then specifying hex at 0